KR20200020515A - Controller area network system and message authentication method - Google Patents

Abstract

Disclosed are a CAN system and a message authentication method. The CAN system comprises a plurality of electronic control units (ECU) mutually transmitting and receiving messages and a gateway generating a session key generating random number to transmit the same to the ECUs. The ECUs generate a session key based on the received session key generating random number and a first ECU in the ECUs generates a first MAC based on the generated session key and a MAC generating random number and transmits a message containing the generated first MAC and the MAC generating random number to a second ECU in the ECUs. The second ECU generates a second MAC based on the generated session key and the received MAC generating random number and determines whether the received first MAC is the same as the generated second MAC to authenticate the received message. Accordingly, the present invention has a high security.

Description

CONTROLLER AREA NETWORK SYSTEM AND MESSAGE AUTHENTICATION METHOD}

The present disclosure relates to a CAN system and a message authentication method, and more particularly, to a CAN system and a message authentication method for authenticating a message to securely send and receive messages between ECUs.

Modern vehicles contain many electrical components in addition to mechanical and hydraulic systems for maximum safety and efficiency. As the number of electronic components increases, the number of electronic control units (ECUs) that control electronic components is increasing, and in-vehicle communication is used to connect and control the ECUs.

The networks commonly used in the three major sectors of the vehicle (Powertrain, Chassis, Body) are the Controller Area Network (CAN), the Local Interconnect Network (LIN), and the FlexRay, which minimizes manufacturing costs, real-time processing, automation, and distributed processing. CAN is a widely used network in demanding vehicles.

CAN is a multi-master network and transmits messages in the CSMA / CD & AMP (Carrier Sense Multiple Access / Collision Detection with Arbitration on Message Priority). CAN nodes (e.g. ECUs) first determine if the bus is idle and busy before sending a message. If data from multiple nodes flows into the bus at the same time and a transmission conflict occurs, CAN compares the value of the Arbitration Field (or Message ID) to determine the transmission priority, and only the node with the highest priority message. Acquire permission to use this CAN bus. At this time, the lower the ID of the message, the higher the transmission priority. The node with the lower priority message goes to standby and tries to retransmit on the next bus cycle. That is, only one node can access the CAN bus at a time, compare the priorities based on the Arbitration Field as described above, and only the highest priority messages will continue to be sent. listening) mode. Because CAN uses the message addressing method, messages can be distinguished by only an identifier (Arbitration Field), and no identification information of the transmitting node is used.

The CAN protocol, designed for in-vehicle networks in the past, was not required to take into account external hacking or countermeasures against malicious control operations. Therefore, in the current vehicle internal network, which is changing to an open network, security technology due to the increased threat of external attack is inadequate, and a method for supplementing the vulnerability to the attack is not defined in the standard protocol.

The CAN protocol is very vulnerable to message forgery attack because there is no sender and receiver identification and no separate fields for authentication. In addition, the CAN protocol adopts an insecure broadcast communication method, so that an attacker can easily intercept a message in a network, and can replay and masquerade attacks by retransmitting or tampering with received content.

Recently, encryption-based authentication method, group-based unanimity authentication method, MAC-based authentication method, group MAC authentication method, etc. have been proposed for security of CAN protocol.

Authentication method based on encryption (using private key and public key) may be considered, but it is difficult to apply because encryption method requires a large amount of computation and modification of hardware and CAN frame. The group-based unanimity authentication method has a problem in that a new application layer must be implemented in the current CAN protocol to verify authentication of members in a group. The MAC-based authentication method has a problem in that the key to be used is generated in advance, which is limited to the ECU memory size and needs to be generated again after authentication. The group MAC authentication method has a problem in that it is difficult to obtain the advantages of group MAC authentication when the number of nodes increases, and key management becomes difficult when the number of groups increases.

Accordingly, there is a need for a message authentication method of a CAN system that can be applied and operate smoothly without changing the current CAN protocol.

The present disclosure is to solve the above-mentioned problems, an object of the present disclosure is to provide a CAN system and a message authentication method that can be applied without modification of the current CAN protocol, is highly scalable, and robust to an attacker's attack.

According to an embodiment of the present disclosure for achieving the above object, a controller area network (CAN) system generates a plurality of electronic control unit (ECU) and session key generation random number to send and receive messages to each other, the plurality of And a gateway for transmitting to an ECU, wherein the plurality of ECUs generate a session key based on the received session key generation random number, and a first ECU of the plurality of ECUs is based on the generated session key and MAC generation random number. Generate a first message authentication code (MAC), and transmit a message including the generated first MAC and the random number of the MAC to a second ECU of the plurality of ECUs, wherein the second ECU transmits the generated session; A second MAC is generated based on a key and the received MAC random number, and it is determined whether the received first MAC is identical to the generated second MAC to authenticate the received message.

The first ECU generates a message transmission key based on the session key and the MAC random number, and generates a first MAC based on the generated message transmission key, the MAC random number and data. The first MAC, the MAC random number, and the data may be included in the data field of the message and transmitted to the second ECU.

The second ECU generates a message receiving key based on the MAC key random number included in the session key and the data field of the received message, and generates the MAC message included in the generated message receiving key and the data field. A second MAC may be generated based on the random number and the data.

The gateway may update the session key generation random number at each preset time.

The gateway may also update the session key based on the updated session key generation random number and hash function.

The gateway may generate an update transmission key based on the session key and the session update MAC generation random number, and generate a first update MAC based on the generated update transmission key, the session update MAC generation random number, and the update data. The generated first update MAC, the updated session key generation random number, the session update MAC generation random number, and the update data may be included in a data field of an update message and transmitted to the plurality of ECUs.

Meanwhile, each of the plurality of ECUs generates an update receiving key based on the session update MAC generation random number included in the session key and the data field of the received update message, and includes the generated update receiving key in the data field. Generate a second update MAC based on the generated session update MAC generation random number and the update data, and determine whether the received first update MAC is identical to the generated second update MAC to authenticate the received update message. The session key may be updated based on the updated session key generation random number and a hash function.

According to an embodiment of the present disclosure for achieving the above object, in the message authentication method of the CAM system, the gateway generates a session key generation random number and transmits it to a plurality of ECU, the session received by the plurality of ECU Generating a session key based on a key generation random number; generating, by a first ECU of the plurality of ECUs, a first MAC based on the generated session key and a MAC generation random number; Transmitting a message including a first MAC and the MAC random number to a second ECU of the plurality of ECUs, wherein the second ECU generates a second MAC based on the generated session key and the received MAC generated random number; Generating the second ECU and determining whether the received first MAC is identical to the generated second MAC to authenticate the received message.

The generating of the first MAC may include generating a message transmission key based on the session key and the MAC random number, and generating a first MAC based on the generated message transmission key, the MAC random number and data. The transmitting to the second ECU may include the generated first MAC, the MAC random number, and the data in the data field of the message and transmit the same to the second ECU.

The generating of the second MAC may include generating a message receiving key based on the MAC key random number included in the session key and the data field of the received message, and including the generated message receiving key in the data field. The second MAC may be generated based on the received MAC generation random number and the data.

Meanwhile, the message authentication method of the CAM system may further include updating the session key, and in the updating of the session key, the gateway may update the session key generation random number at a predetermined time.

In the updating of the session key, the gateway may update the session key based on the updated session key generation random number and a hash function.

The updating of the session key may include: generating, by the gateway, an update transmission key based on the session key and the session update MAC generation random number, and based on the generated update transmission key, the session update MAC generation random number, and the update data. Generate a first update MAC, and include the generated first update MAC, the updated session key generation random number, the session update MAC generation random number, and the update data in a data field of an update message and transmit the same to the plurality of ECUs. Can be.

The updating of the session key may include: generating, by each of the plurality of ECUs, an update receiving key based on the session update MAC generation random number included in the data field of the session key and the received update message; A second update MAC is generated based on a reception key, the session update MAC generation random number included in the data field, and the update data, and determines whether the received first update MAC is identical to the generated second update MAC. Authenticate the received update message, and update the session key based on the updated session key generation random number and a hash function.

As described above, the CAN system and the message authentication method generate a MAC based on a current key and a random number each time a message is transmitted, thereby having high security.

In addition, since the CAN system and the message authentication method change a key used for MAC generation at a predetermined time, the CAN system and the message authentication method can cope with an attack by the attacker.

In addition, the CAN system and message authentication method can be applied without modifying the existing CAN protocol.

In addition, the CAN system and message authentication method can be applied without modification of the algorithm even if the CAN system changes.

In addition, the CAN system and message authentication method do not require much resources, enable message authentication in a short time, and are compatible with existing devices.

1 is a diagram illustrating a CAN system according to an exemplary embodiment of the present disclosure.
2 is a diagram illustrating a key generation method and a hash pool using a hash chain according to an embodiment of the present disclosure.
3 is a timing diagram illustrating a process of transmitting and authenticating a message between ECUs according to an exemplary embodiment of the present disclosure.
4 is a timing diagram illustrating a process of updating a session key according to an embodiment of the present disclosure.
5 is a flowchart illustrating a message authentication method of a CAM system according to an embodiment of the present disclosure.

Hereinafter, various embodiments will be described in more detail with reference to the accompanying drawings. Embodiments described herein may be variously modified. Specific embodiments may be depicted in the drawings and described in detail in the detailed description. However, the specific embodiments disclosed in the accompanying drawings are only for easily understanding the various embodiments. Therefore, the technical spirit is not limited by the specific embodiments disclosed in the accompanying drawings, and it should be understood to include all equivalents or substitutes included in the spirit and scope of the invention.

 Terms including ordinal numbers such as first and second may be used to describe various components, but these components are not limited by the terms described above. The terms described above are used only for the purpose of distinguishing one component from another.

As used herein, the terms "comprises" or "having" are intended to indicate that there is a feature, number, step, action, component, part, or combination thereof described on the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof. When a component is said to be "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that another component may be present in the middle. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

On the other hand, "module" or "unit" for the components used in the present specification performs at least one function or operation. In addition, the "module" or "unit" may perform a function or an operation by hardware, software, or a combination of hardware and software. In addition, a plurality of "modules" or a plurality of "parts" other than a "module" or a "part" to be performed in specific hardware or performed by at least one control unit may be integrated into at least one module. Singular expressions include plural expressions unless the context clearly indicates otherwise.

In addition, in describing the present invention, when it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be abbreviated or omitted. Meanwhile, although each embodiment may be independently implemented or operated, each embodiment may be implemented or operated in combination.

1 is a diagram illustrating a controller area network (CAN) system according to an embodiment of the present disclosure.

Referring to FIG. 1, the CAN system 100 includes a gateway 110 and one or more electronic control units (ECUs) 120-1, 120-2, 120-3, 120-4, and 120-5. Each ECU One or more ECUs 120-1, 120-2, 120-3, 120-4, and 120-5 send and receive messages to each other. For example, when the first ECU 120-1 transmits a message including information about an ECU and information about priority of a ECU to process a message in a broadcasting manner, the remaining ECUs 120-2 and 120-3 are transmitted. , 120-3, 120-4, and 120-5 receive the message transmitted from the first ECU 120-1, and process the received message according to the priority of only a specific ECU based on the information included in the message. do. In addition, the first ECU 120-1 processes a message received from another ECU in the same manner. That is, each of the ECUs 120-1, 120-2, 120-3, 120-4, and 120-5 may serve as a sender and a receiver according to a situation.

The gateway 110 connects the CAN system 100 to another external system or network, manages sessions, and transmits an update message to each ECU for changing a key used when generating a MAC (Message Authentication Code). A session is a time interval from when a start point of a session key of a hash pool used when generating a MAC for message authentication is changed to a next change time. Each session has a different starting point for the session key used to generate the MAC. If the CAN system 100 continuously uses the chain session key after fixing the start order of the key to be used at a specific point in the hash pool without applying the session, the CAN system 100 may be due to the fixed length of the MAC. We are vulnerable to brute forcing attacks. Therefore, the CAN system 100 can be robust against a full attack by establishing a session to periodically change the starting point of the session key in a hash pool having a hash collision-free key.

The gateway 110 transmits the update message to all the ECUs 120-1, 120-2, 120-3, 120-4, and 120-5. The gateway 110 does not directly include the key in the message and transmit the message, but instead selects a session key for each ECU 120-1, 120-2, 120-3, 120-4, and 120-5. Send a message with a key generation random number). That is, the gateway 110 generates a session key generation random number r _g (j) for message authentication and transmits it to each of the ECUs 120-1, 120-2, 120-3, 120-4, and 120-5. do.

Each of the plurality of ECUs 120-1, 120-2, 120-3, 120-4, and 120-5 is based on a session key generation random number r _g (j) received from the gateway 110. Generate the key (K ^j ). Subsequently, the sender ECU among the plurality of ECUs 120-1, 120-2, 120-3, 120-4 and 120-5 generates a session key K ^j and a random number MAC generated random number r _e (M _k ). Generate a MAC based on the MAC, and transmit a message including the generated MAC and the MAC random number r _e (M _k ) to the receiver ECU. As described above, the sender ECU of the CAN system 100 transmits the message to all ECUs in a broadcast manner, but only a specific ECU related to the transmitted message among the plurality of ECUs receiving the message processes the received message. In conclusion, the sender ECU sends a message to the receiver ECU.

The receiver ECU generates a MAC based on the generated session key K ^j and the received MAC generated random number r _e (M _k ). The receiver ECU determines whether the received MAC is identical to the generated MAC, and if so, authenticates the message.

A detailed process of authenticating the message by the receiver ECU and a process of updating the key by the gateway will be described later.

2 is a diagram illustrating a key generation method and a hash pool using a hash chain according to an embodiment of the present disclosure.

The hash pool refers to a set of session keys used when generating a MAC. The hash pool is generated with the same hash chain (or hash function), and means a set of keys generated by performing the hash function n times in succession rather than storing the key in memory. That is, the i th session key of the first ECU and the hash chain and the i th session key of the hash chain of the second ECU are the same. Thus, every ECU is like having one virtual hash pool.

The direction of the key usage of the hash chain of the hash pool is different from that of the one-way hash function. That is, the key usage direction of the hash chain of the present disclosure is the same as the generation direction. If a hash pool consisting of a one-way hash chainkey that is used primarily for authentication is used, a certain amount of hash keys are repeated by hash collisions after sufficient time, and physically builds a hash pool with enough collision-free hash keys for ECUs with limited memory. There is a limit to storing.

The CAN system of the present disclosure can solve the exposure problem of the key starting point by using a random number of the gateway to determine the MAC generation key in the hash pool having a hash collision-free key without applying a one-way hash chain.

)를 선택할 수 있다.The gateway sends a session key generation random number r _g (j) to each ECU, and each ECU uses the same session key K ^j generated based on the received session key generation random number r _g (j). do. The generated session key (K ^j ) is valid only in the current session j. When the session is changed (from session j to session j + 1), each ECU receives the newly updated updated session key generation random number (r _g (j +). You can perform a hash chain function based on 1)). The gateway may update the session key generation random number every predetermined time. Thus, each ECU has a new hash pool's session key (

) Can be selected.

The following describes the process of authenticating a message when sending a message from the sender ECU to the receiver ECU.

3 is a timing diagram illustrating a process of transmitting and authenticating a message between ECUs according to an exemplary embodiment of the present disclosure.

Referring to FIG. 3, a first ECU 120-1 and a second ECU 120-2 are shown. The first ECU 120-1 may be a sender ECU and the second ECU 120-2 may be a receiver ECU.

)를 생성한다(S320). 메시지 전송키(

)는 현재 세션키(K^j)에서 MAC 생성 난수(r₁(M₁))의 크기 만큼 해시 함수를 사용하여 생성될 수 있다. 메시지 전송키(

)는 송신하려는 단일 메시지에서만 유효하다. 제1 ECU(120-1)는 제1 MAC를 생성한다(S330). 제1 MAC는 데이터, MAC 생성 난수(r₁(M₁)) 및 메시지 전송키(

)에 해시 함수를 사용하여 생성될 수 있다. 제1 ECU(120-1)는 메시지의 데이터 필드에 데이터, MAC 생성 난수(r₁(M₁)) 및 제1 MAC를 포함시켜 제1 메시지(M₁)를 제2 ECU(120-2)로 전송한다(S340).The first ECU 120-1 generates a MAC generation random number r ₁ (M ₁ ) to transmit the first message M ₁ (S310). The first ECU 120-1 may transmit a message transmission key based on the current session key K ^j and the MAC random number r ₁ (M ₁ ).

) Is generated (S320). Message transfer key (

) May be generated using a hash function as large as the MAC random number r ₁ (M ₁ ) in the current session key (K ^j ). Message transfer key (

) Is valid only for a single message to be sent. The first ECU 120-1 generates a first MAC (S330). The first MAC includes data, a MAC generated random number r ₁ (M ₁ ), and a message transmission key (

) Can be created using a hash function. The first ECU 120-1 includes the data, the MAC generation random number r ₁ (M ₁ ), and the first MAC in the data field of the message to include the first message M ₁ in the second ECU 120-2. It transmits to (S340).

)를 생성한다(S350). 메시지 수신키(

)는 현재 세션키(K^j)에서 수신된 MAC 생성 난수(r₁(M₁))의 크기 만큼 해시 함수를 사용하여 생성될 수 있다. 제2 ECU(120-2)는 제2 MAC를 생성한다(S360). 제2 MAC는 데이터, 수신된 MAC 생성 난수(r₁(M₁)) 및 생성된 메시지 수신키(

)에 해시 함수를 사용하여 생성될 수 있다. 제2 ECU(120-2)는 MAC를 인증한다(S370). 제2 ECU(120-2)는 수신된 제1 MAC와 생성된 제2 MAC를 비교하여 동일한지 여부를 판단한다. 제2 ECU(120-2)는 제1 MAC와 제2 MAC가 동일하면 수신된 제1 메시지를 처리하고, 동일하지 않으면 수신된 제1 메시지를 버린다. 상술한 과정을 통해 CAN 시스템은 송수신되는 메시지를 인증할 수 있다.The second ECU 120-2 receives the first message M ₁ from the first ECU 120-1. The second ECU 120-2 may generate a message receiving key based on the MAC generated random number r ₁ (M ₁ ) included in the first message M ₁ .

) Is generated (S350). Message Receive Key (

) May be generated using the hash function by the size of the MAC generated random number r ₁ (M ₁ ) received from the current session key (K ^j ). The second ECU 120-2 generates a second MAC (S360). The second MAC includes data, a received MAC generated random number r ₁ (M ₁ ), and a generated message receiving key (

) Can be created using a hash function. The second ECU 120-2 authenticates the MAC (S370). The second ECU 120-2 compares the received first MAC with the generated second MAC and determines whether they are the same. The second ECU 120-2 processes the received first message if the first MAC and the second MAC are the same, and discards the received first message if it is not the same. Through the above-described process, the CAN system can authenticate messages transmitted and received.

Meanwhile, the CAN system may update the current session key K ^j every predetermined time for security. The following describes the process of updating the session key by the CAN system.

4 is a timing diagram illustrating a process of updating a session key according to an embodiment of the present disclosure.

)를 생성할 수 있다(S415). 갱신 전송키(

)는 현재 세션키(K^j)에서 세션 갱신 MAC 생성 난수(r_g(M₂))의 크기 만큼 해시 함수를 사용하여 생성될 수 있다. 게이트웨이(110)는 제1 갱신 MAC를 생성한다(S420). 제1 갱신 MAC은 갱신 데이터, 세션 갱신 MAC 생성 난수(r_g(M₂)) 및 갱신 전송키(

)에 해시 함수를 사용하여 생성될 수 있다. 게이트웨이(110)는 메시지의 데이터 필드에 갱신 데이터, 세션 갱신 MAC 생성 난수(r_g(M₂)), 갱신된 세션키 생성 난수(r_g(j+1)) 및 제1 갱신 MAC를 포함시켜 세션 갱신 메시지(M₂)를 제1 내지 제3 ECU(120-1, 120-2, 120-3)로 전송할 수 있다(S425). 즉, 게이트웨이(110)는 갱신된 세션키 생성 난수(r_g(j+1))를 포함하는 세션 갱신 메시지(M₂)를 모든 ECU에 브로드캐스트할 수 있다. 그리고, 게이트웨이(110)는 갱신된 세션키 생성 난수(r_g(j+1))에 해시 함수를 사용하여 새로운 세션키(K^j+1)를 생성하고, 현재 세션키(K^j)를 새로운 세션키(K^j+1)로 변경할 수 있다(S430).Referring to FIG. 4, a gateway 110, a first ECU 120-1, a second ECU 120-2, and a third ECU 120-3 are illustrated. The gateway 110 may generate an updated session key generation random number r _g (j + 1) to change the session at regular intervals (S405). The gateway 110 may generate a session update MAC generation random number r _g (M ₂ ) to transmit the session update message M ₂ (S410). The gateway 110 uses the update transmission key (based on the current session key K ^j ) and the session update MAC generation random number r _g (M ₂ ).

) Can be generated (S415). Update transfer key (

) May be generated using the hash function by the size of the session update MAC generation random number r _g (M ₂ ) in the current session key (K ^j ). The gateway 110 generates a first update MAC (S420). The first update MAC includes update data, a session update MAC generation random number r _g (M ₂ ), and an update transmission key (

) Can be created using a hash function. The gateway 110 includes the update data, the session update MAC generation random number r _g (M ₂ ), the updated session key generation random number r _g (j + 1), and the first update MAC in the data field of the message. The session update message M ₂ may be transmitted to the first to third ECUs 120-1, 120-2, and 120-3 (S425). That is, the gateway 110 may broadcast a session update message M ₂ including the updated session key generation random number r _g (j + 1) to all ECUs. In addition, the gateway 110 generates a new session key K ^{j + 1} using a hash function to the updated session key generation random number r _g (j + 1), and converts the current session key K ^j to a new one. The session key K ^{j + 1} may be changed (S430).

The first to third ECUs 120-1, 120-2, and 120-3 may receive the session update message M ₂ from the gateway 110. Each of the plurality of ECUs 120-1, 120-2, and 120-3 may authenticate the session update message M ₂ and change the session key in the same manner. Hereinafter, the first ECU 120-1 will be representatively described.

)를 생성할 수 있다(S435). 갱신 수신키(

)는 현재 세션키(K^j)에서 수신된 세션 갱신 MAC 생성 난수(r_g(M₂))의 크기 만큼 해시 함수를 사용하여 생성될 수 있다. 제1 ECU(120-1)는 제2 갱신 MAC를 생성할 수 있다(S440). 제2 갱신 MAC는 갱신 데이터, 수신된 세션 갱신 MAC 생성 난수(r_g(M₂)) 및 생성된 갱신 수신키(

)에 해시 함수를 사용하여 생성될 수 있다. 제1 ECU(120-1)는 MAC를 인증할 수 있다(S445). 제1 ECU(120-1)는 수신된 제1 갱신 MAC와 생성된 제2 갱신 MAC를 비교하여 동일한지 여부를 판단할 수 있다. 제1 ECU(120-1)는 제1 갱신 MAC와 제2 갱신 MAC가 동일하면 수신된 세션 갱신 메시지(M₂)를 처리하고, 동일하지 않으면 수신된 세션 갱신 메시지(M₂)를 버릴 수 있다. 세션 갱신 메시지(M₂)가 인증되면 제1 ECU(120-1)는 세션변경 절차를 수행할 수 있다. 제1 ECU(120-1)는 수신한 세션키 생성 난수(r_g(j+1))의 크기 만큼 해시 함수를 사용하여 새로운 세션키(K^j+1)를 생성하고, 현재 세션키(K^j)를 새로운 세션키(K^j+1)로 변경할 수 있다(S450).The first ECU 120-1 may generate an update receiving key based on the session update MAC generation random number r _g (M ₂ ) included in the session update message M ₂ .

) May be generated (S435). Update Receive Key (

) May be generated using the hash function by the size of the session update MAC generation random number (r _g (M ₂ )) received from the current session key (K ^j ). The first ECU 120-1 may generate a second update MAC (S440). The second update MAC includes update data, received session update MAC generation random number r _g (M ₂ ), and generated update receiving key (

) Can be created using a hash function. The first ECU 120-1 may authenticate the MAC (S445). The first ECU 120-1 may compare the received first update MAC with the generated second update MAC and determine whether the same is the same. The first ECU 120-1 may process the received session update message M ₂ if the first update MAC and the second update MAC are the same, and discard the received session update message M ₂ if they are not the same. . When the session update message M ₂ is authenticated, the first ECU 120-1 may perform a session change procedure. The first ECU 120-1 generates a new session key K ^{j + 1} using a hash function by the size of the received session key generation random number r _g (j + 1), and generates the current session key K. ^j ) may be changed to a new session key (K ^{j + 1} ) (S450).

So far, an embodiment of a message authentication method of a CAN system has been described. Below is a flow chart of the message authentication method.

5 is a flowchart illustrating a message authentication method of a CAM system according to an embodiment of the present disclosure.

The gateway generates a session key generation random number (r _g (j)) and transmits it to the plurality of ECUs (S510). The plurality of ECUs generate a session key K ^j based on the received session key generation random number r _g (j) (S520). The generated session key K ^j is valid only for the current session (session j).

)를 생성하고, 메시지 전송키(

), MAC 생성 난수(r_e(M_k)) 및 데이터에 기초하여 제1 MAC를 생성한다.The first ECU (sender ECU) of the plurality of ECUs generates the first MAC based on the generated session key K ^j and the MAC random number r _e (M _k ) (S530). The first ECU transmits a message transmission key based on the session key K ^j and the MAC random number r _e (M _k ).

) And the message transfer key (

), A first MAC is generated based on the MAC generation random number r _e (M _k )) and data.

The first ECU transmits a message M _k including the generated first MAC and the MAC random number r _e (M _k ) to a second ECU (receiver ECU) of the plurality of ECUs (S540). The first ECU transmits the first MAC, the MAC random number r _e (M _k ) and the data to the second ECU by including the data in the data field of the message M _k .

)를 생성하고, 메시지 수신키(

), MAC 생성 난수(r_e(M_k)) 및 데이터에 기초하여 제2 MAC를 생성한다.The second ECU generates a second MAC based on the generated session key K ^j and the received MAC generated random number r _e (M _k ) (S550). The ECU 2 is received by the message based on the session key (K ^j) the message (M _k) of the MAC generated random number (r _e (M _k)) included in the data field and the received key (

) And the message receiving key (

), A second MAC is generated based on the MAC generation random number r _e (M _k )) and data.

The second ECU determines whether the received first MAC is identical to the generated second MAC and authenticates the received message (S560). The second ECU 120-2 compares the first MAC with the second MAC and determines whether they are the same. The second ECU 120-2 processes the received message if the first MAC and the second MAC are the same, and discards the received message if it is not the same. Through the above-described process, the CAN system can authenticate messages transmitted and received.

The message authentication method of the CAN system according to the above-described various embodiments may be provided as a computer program product. The computer program product may include the S / W program itself or a non-transitory computer readable medium in which the S / W program is stored.

The non-transitory readable medium refers to a medium that stores data semi-permanently and can be read by a device, not a medium storing data for a short time such as a register, a cache, or a memory. Specifically, the various applications or programs described above may be stored and provided in a non-transitory readable medium such as a CD, a DVD, a hard disk, a Blu-ray disk, a USB, a memory card, a ROM, or the like.

In addition, although the preferred embodiment of the present invention has been shown and described above, the present invention is not limited to the above-described specific embodiment, the technical field to which the invention belongs without departing from the spirit of the invention claimed in the claims. Of course, various modifications can be made by those skilled in the art, and these modifications should not be individually understood from the technical spirit or the prospect of the present invention.

100: CAN system 110: gateway
120-1, 120-2, 120-3, 120-4, 120-5: ECU

Claims (14)

A plurality of ECU (Electronic Control Unit) for transmitting and receiving messages between each other; And
A gateway for generating a session key generation random number and transmitting the random number to the plurality of ECUs;
The plurality of ECUs,
Generates a session key based on the received session key generation random number,
A first ECU of the plurality of ECUs,
Generate a first MAC (Message Authentication Code) based on the generated session key and the MAC random number, and transmits a message including the generated first MAC and the MAC random number to a second ECU of the plurality of ECUs ,
The second ECU,
CAN for generating a second MAC based on the generated session key and the received MAC generation random number, and determining whether the received first MAC is identical to the generated second MAC to authenticate the received message. Controller Area Network System. The method of claim 1,
The first ECU,
Generate a message transfer key based on the session key and the random number generated by the MAC, generate a first MAC based on the generated message transfer key, the random number generated by the MAC, and the data; generate the first MAC, the MAC CAN system for including the generated random number and the data in the data field of the message to the second ECU. The method of claim 2,
The second ECU,
Generate a message receiving key based on the session key and the MAC generated random number included in the data field of the received message, and based on the generated message receiving key, the MAC generated random number included in the data field and the data CAN system for generating a second MAC. The method of claim 1,
The gateway is,
CAN system for updating the session key generation random number every predetermined time. The method of claim 4, wherein
The gateway is,
CAN system for updating the session key based on the updated session key generation random number and hash function. The method of claim 4, wherein
The gateway is,
Generate an update transmission key based on the session key and the random number of the session update MAC generation, generate a first update MAC based on the generated update transmission key, the session update MAC generation random number, and the update data, CAN system for transmitting the 1 update MAC, the updated session key generation random number, the session update MAC generation random number, and the update data in the data field of the update message to the plurality of ECUs. The method of claim 6,
Each of the plurality of ECUs,
Generate an update reception key based on the session update MAC generation random number included in the session key and the data field of the received update message, generate the update reception key, the session update MAC generation random number included in the data field, and Generates a second update MAC based on the update data, determines whether the received first update MAC is identical to the generated second update MAC, authenticates the received update message, and generates the updated session key. CAN system for updating the session key based on random numbers and hash functions. Generating, by the gateway, a session key generation random number and transmitting the random number to a plurality of ECUs;
Generating a session key by the plurality of ECUs based on the received session key generation random number;
Generating, by a first ECU of the plurality of ECUs, a first MAC based on the generated session key and a MAC random number;
Transmitting, by the first ECU, a message including the generated first MAC and the MAC random number to a second ECU of the plurality of ECUs;
Generating, by the second ECU, a second MAC based on the generated session key and the received MAC generated random number; And
And authenticating, by the second ECU, whether the received first MAC is identical to the generated second MAC, and authenticating the received message. The method of claim 8,
Generating the first MAC,
Generate a message transfer key based on the session key and the random number generated by the MAC, generate a first MAC based on the generated message transfer key, the random number generated by the MAC, and the data;
The transmitting to the second ECU,
Message generation method of the CAM system including the generated first MAC, the MAC random number and the data in the data field of the message to the second ECU. The method of claim 9,
Generating the second MAC,
Generate a message receiving key based on the session key and the MAC generated random number included in the data field of the received message, and based on the generated message receiving key, the MAC generated random number included in the data field and the data Message authentication method of the CAM system for generating a second MAC. The method of claim 8,
Updating the session key;
Updating the session key,
Message authentication method of the CAM system that the gateway updates the session key generation random number at a predetermined time. The method of claim 11,
Updating the session key,
And the gateway updates the session key based on the updated session key generation random number and hash function. The method of claim 11,
Updating the session key,
The gateway generates an update transmission key based on the session key and the session update MAC generation random number, and generates a first update MAC based on the generated update transmission key, the session update MAC generation random number and update data, and And a generated first update MAC, the updated session key generation random number, the session update MAC generation random number, and the update data in a data field of an update message to the plurality of ECUs. The method of claim 13,
Updating the session key,
Each of the plurality of ECUs generates an update receiving key based on the session update MAC generation random number included in the session field and the data field of the received update message, and generates the generated update receiving key and the data field. Generate a second update MAC based on a session update MAC generation random number and the update data, determine whether the received first update MAC is identical to the generated second update MAC, and authenticate the received update message; Message authentication method of a CAM system for updating the session key based on the updated session key generation random number and a hash function.

Images